JP2017517956A - Digital certificate processing and verification - Google Patents

Abstract

Collect user digital certificates. A digest calculation of the collection result of the digital certificate is performed to generate a digital certificate digest of the user. Cache the digital certificate digest. In response to a user operation, a service request including a cached digital certificate digest is sent to the service server, so that the service corresponding to the service request is a service that requires digital certificate verification. If the verification passes through the verification of the digital certificate digest, the service server executes the service. Since the technique of the present disclosure performs a digital certificate verification operation together with a specific service operation, the number of certificate verifications and the number of requests for specific service execution are reduced.

Description

This application claims the foreign priority of Chinese Patent Application No. 201410225581.9 `` Method and Apparatus for Processing and Validating Digital Certificate '' filed May 26, 2014, which is hereby incorporated by reference in its entirety. Incorporate into.

  The present disclosure relates to the field of Internet technology, and more particularly to a method and apparatus for digital certificate processing and verification.

  Currently, many websites with high security requirements require users to use digital certificate products. Digital certificates can be classified into two types according to the storage mode. One type is a digital certificate such as a USB key stored in a hardware medium and is often referred to as a “hard certificate”. The other is a digital certificate stored (installed) in a local client (desktop computer, notebook computer, etc.) and is often referred to as a “soft certificate”. For operations with high security requirements, a second verification is usually performed by employing digital certificates to ensure the security of user operations. However, since the digital certificate is installed on the local client and the certificate validation and processing logic is on the server side, it collects the certificate installed on the local client before performing operations with high security requirements, It is necessary to submit the certificate to the server side for certificate matching verification. In such a mode, a large amount of data is transmitted over the network, causing network traffic to be wasted and a certificate collection and submission step needs to be added before each operation with high security requirements.

  With respect to such problems, existing solutions collect and submit a certificate after the user logs in, verify the certificate, and cache the verification results, as shown in detail in FIG. FIG. 1 is a schematic diagram showing an interaction between a browser and a corresponding server in an existing digital certificate verification solution. Since digital certificate verification needs to be performed, the operations that need to be performed to complete the login of the user are to request login at step 110, collect certificate information at step 120, and at step 130. Submitting certificate information; verifying the certificate in step 140 and caching the certificate verification result; initiating a corresponding service request in response to a user operation in step 150; Executing the service.

  The existing solution shown in FIG. 1 has the following obvious drawbacks: (1) Each time a user logs in, the client terminal needs to perform certificate collection and submission operations. Thus, if only 20% of users need to verify certificates to perform operations with high security requirements, this means that 80% of certificate submission and verification operations are wasted (2 ) Because the amount of digital certificates is relatively large, when submitting the collected certificate content to the server for verification, the certificate is typically placed in the form of a form item and submitted to the server in POST mode. .

  This summary is a brief introduction to some of the concepts and will be more fully described in the Detailed Description. This summary is not intended to identify all important or essential features of the claimed subject matter, but is used alone to help determine the scope of the claimed subject matter. Also not intended. For example, the term “technology” refers to apparatus (s), system (s), method (s), and / or computer readable instructions, depending on the above context and throughout the present disclosure. Good.

  The present disclosure provides a method and apparatus for processing and verifying digital certificates to solve the problem of wasting of prior art certificate submission and verification operations and large numbers of digital certificates.

  The present disclosure provides an example of a method for processing a digital certificate. Collect user digital certificates. A digest calculation of the digital certificate collection result is performed to generate a digital certificate digest for the user. Cache the digital certificate digest. In response to a user operation, when a service request including a cached digital certificate digest is sent to the service server, so that the service corresponding to the service request is a service that requires digital certificate validation, If the verification passes through the verification of the digital certificate digest, the service server executes the service.

  The present disclosure provides an example of an apparatus for processing a digital certificate. The apparatus may comprise the following modules: The collection module collects the user's digital certificate. The digest module performs a digest calculation of the digital certificate collection result to generate a user digital certificate digest. The cache module caches the digital certificate digest. The transmission module transmits a service request including the cached digital certificate digest to the service server in response to a user operation. When the service corresponding to the service request is a service that requires the verification of the digital certificate, the service server executes the service when the verification is passed through the verification of the digital certificate digest.

  The present disclosure also provides an example of a method for validating a digital certificate. The client terminal collects the user's digital certificate, performs digest calculation of the digital certificate collection result, generates the user's digital certificate digest, caches the digital certificate digest, and responds to the user's operation And send a service request including the cached digital certificate digest to the service server. The service server receives the service request. When the service corresponding to the service request is a service that requires verification of the digital certificate, the service server verifies the digital certificate digest.

  The present disclosure further provides an example system for validating a digital certificate. The system may comprise a client terminal and a service server. The client terminal includes the following modules. The collection module collects the user's digital certificate. The digest module performs a digest calculation of the digital certificate collection result to generate a user digital certificate digest. The cache module caches the digital certificate digest. The transmission module transmits a service request including the cached digital certificate digest to the service server in response to a user operation. The service server may comprise the following modules: The receiving module receives a service request. The verification module verifies the digital certificate digest when the service corresponding to the service request is a service that requires verification of the digital certificate.

Compared to existing technologies, the solution according to the technology of the present disclosure has at least the following beneficial technical effects:
1) The number of certificate verifications is reduced by performing digital certificate verification operations and specific service operations together.
2) Since there is no need to submit certificate information through the POST page, the number of requests to perform a specific service is reduced.
3) Since the digital certificate is cached, each operation performed by the user after the user logs in can be attached to the certificate digest. As a result, certificate verification may be performed at any time as necessary.

The drawings described herein are used for further understanding of the present disclosure and form part of the present disclosure. The example embodiments of the present disclosure and their descriptions are used to describe the present disclosure and are not intended to impose inappropriate limitations on the present disclosure.
It is the schematic which shows the interaction of the browser of a client terminal, and a corresponding server in the existing digital certificate verification solution. 6 is a flowchart illustrating an example of a method for processing a digital certificate according to an example embodiment of the present disclosure. 5 is a flowchart illustrating an example method for verifying a digital certificate according to an example embodiment of the present disclosure. FIG. 6 is a schematic diagram illustrating browser-server interaction in an example method for validating a digital certificate according to another example embodiment of the present disclosure. FIG. 3 is a structural diagram illustrating an example of an apparatus for processing a digital certificate according to an example embodiment of the present disclosure. FIG. 3 is a structural diagram illustrating an example of a system for verifying a digital certificate according to an embodiment of the present disclosure.

  The technology of the present disclosure performs a digest calculation of a digital certificate collection result and caches the digital certificate digest generated by the calculation. As a result, each time a user performs an operation, the browser performs a digital certificate digest. A request containing is sent to the corresponding server. Therefore, when the user's operation is an operation that requires digital certificate verification, the server collects the digital certificate digest and performs digital certificate verification.

  To clarify the objectives, technical solutions, and advantages of the present disclosure, the technical solutions of the present disclosure are described below with reference to exemplary embodiments of the present disclosure and corresponding figures. Apparently, the described embodiments are only a part of the embodiments of the present disclosure, not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present disclosure without creative efforts shall fall within the protection scope of the present disclosure.

  In accordance with an example embodiment of the present disclosure, a method for processing a digital certificate is provided.

  FIG. 2 illustrates an example method for processing a digital certificate according to an example embodiment of the present disclosure. The technical solutions of the present disclosure may be applied to websites or web page applications (such as data interaction applications) that have high security requirements for verifying a user's digital certificate. For example, when a web page application is used via a browser, digital certificate verification regarding a user's specific operation, that is, verification regarding the user's digital certificate is performed.

  At 210, the user's digital certificate is collected.

  For example, when a user visits a website via a browser on a client terminal (desktop computer, laptop computer, etc.), digital certificates installed on the local client are collected via browser controls.

  According to the example embodiment of the present disclosure, when a user performs a login operation, a login request is transmitted to the login server. The login server and the service server may be the same server or different servers.

  At 220, a digest calculation of the digital certificate collection results is performed to generate a digital certificate digest for the user. In other words, using a specific digest algorithm, a digest calculation regarding the collection result of the digital certificate is performed to generate a digital certificate digest of the user.

  Through digest calculation, calculate a large amount of digital certificate content into smaller content. For example, the collection result of the digital certificate may be calculated as a message digest having a fixed length (such as a character string having a fixed length), that is, a digital certificate digest, using the MD5 (Message Digest Algorithm 5) algorithm. .

  It should be noted that the present disclosure is not limited thereto, and any digest algorithm applicable to the present disclosure may be adopted to perform the digest calculation of the digital certificate collection result. For example, in addition to the MD5 algorithm, an algorithm such as SHA (Secure Hash Algorithm) may be employed.

  At 230, the digital certificate digest is cached. For example, the generated digital certificate digest may be cached in a cookie file.

  At 240, in response to a user operation, a service request including a cached digital certificate digest is sent to the service server. When the service corresponding to the service request is a service that requires verification of the digital certificate, the service server verifies the digital certificate digest, and executes the service when the verification is successful.

  For example, for each operation that the user performs on the web page through the browser, the browser transmits a service request corresponding to the operation to the server in response to the user's operation. The browser may place the user's generated digital certificate digest in the request and send it together to the service server. Since each browser request may be sent with a cookie, the generated digital certificate digest may be cached in a cookie file. When the browser responds to the user's operation and sends a service request corresponding to the operation to the server, the cookie including the digital certificate digest and the service request may be sent together to the service server. When the service server receives the service request, the service server may determine whether the service corresponding to the service request is a service that requires verification of the digital certificate. If the service corresponding to the service request is not a service that requires digital certificate verification, the service server may execute the service directly. If the service corresponding to the service request is a service that has high security requirements and requires verification of the digital certificate (payment, transfer, withdrawal by payment application, etc.), the service server will receive the user's digital certificate digest. May be collected and verified to determine whether the service can be executed. If the verification passes, the service server executes the service, and if the verification fails, an associated prompt message is returned.

  The service server may verify the digital certificate digest according to the following operation. The digest calculation of the user's digital certificate stored in the service server is performed using the digest algorithm employed for generating the digital certificate digest. The digest calculation result is compared with the digital certificate digest. If they are the same, it is determined that the verification has passed. If there is a difference, the verification is judged to have failed. For example, when the algorithm adopted for generating the user's digital certificate digest is MD5, digest calculation related to the digital certificate is performed using the MD5 algorithm, and the digest calculation result is obtained from the user's digital acquired from the request. Compare with certificate digest. If they are the same, it is judged that the verification has passed. If there is a difference, the verification is judged to have failed.

  According to example embodiments of the present disclosure, when a user performs a login operation (ie, the user logs in to a website using an account and password), digital certificates installed on the local client are also collected. In other words, when the user logs in, operation 210 may be executed, and then operations 220 to 240 may be executed in order.

  For example, when a user logs in to a website or web page application via a browser of a client terminal, the browser may send a login request to a login server of the website. When the login server receives the request, operations such as user account and password verification are performed, and when the user login operation is executed, the login server returns a script to the browser. The browser may execute a script to collect the user's digital certificate, generate a digital certificate digest, and cache the generated digital certificate digest. The script may be computer executable code written in a script language, and the login server may place the script in web page data returned to the client terminal and return it to the browser of the client terminal. When the browser receives the web page data returned by the service server (such as the page data after the user logs in), the browser executes the script to collect the digital certificate installed on the client terminal. The digest is calculated to generate a certificate digest, and the certificate digest is cached in a cookie. Since the digital certificate digest is already cached, it is not necessary to collect the digital certificate during future logins, only the digital certificate digest need be read from the cache.

  The present disclosure also provides an example of a method for validating a digital certificate.

  FIG. 3 is a flowchart illustrating an example of a method for verifying a digital certificate according to an embodiment of the present disclosure.

  At 310, the client terminal collects the user's digital certificate.

  For example, when a user visits a website via a browser on a client terminal, digital certificates installed on the local client may be collected via browser controls. The digital certificate installed on the local client may be collected when the user performs a login operation (ie, the user logs in to the website using an account and password).

  At 320, the client terminal performs a digest calculation of the digital certificate collection result to generate a digital certificate digest for the user.

  For example, the client terminal may generate a digital certificate digest of the user by performing a digest calculation of the collection result of the digital certificate using a specific digest algorithm. For example, the collection result of the digital certificate may be calculated as a message digest having a fixed length, that is, a digital certificate digest by using an MD5 (Message Digest Algorithm 5) algorithm.

  At 330, the client terminal caches the digital certificate digest.

  According to example embodiments of the present disclosure, the generated digital digest may be cached in a cookie file.

  In 340, the client terminal transmits a service request including the cached digital certificate digest to the service server in response to the user operation.

  For each operation performed by the user through the browser, the browser of the client terminal may transmit a service request corresponding to the operation to the service server in response to the operation of the user. The browser may place the user generated digital certificate digest in the request and send it together to the service server. For example, since each browser request may be sent with a cookie, the generated digital certificate digest may be cached in a cookie file. When the browser responds to a user operation and sends a service request corresponding to the operation to the service server, a cookie containing a digital certificate digest may be placed in the service request and sent to the service server together.

  At 350, the service server receives a service request.

  In 360, when the service corresponding to the service request is a service that requires digital certificate verification, the service server verifies the digital certificate digest.

  For example, when the service server receives the service request, the service server determines whether the service corresponding to the service request is a service that requires verification of the digital certificate. If the service corresponding to the service request is not a service that requires digital certificate verification, the service server may directly execute the service. If the service corresponding to the service request is a service that requires verification of a digital certificate, such as a service having high security requirements such as payment, transfer, and withdrawal, the service server sends the user's digital certificate digest. It may be collected from a request (such as a cookie carried by the request) and verified to determine whether the service can be performed.

  The service server may verify the digital certificate digest according to the following operation. The digest calculation of the user's digital certificate stored in the service server is performed using the digest algorithm employed for generating the digital certificate digest. Compare the digest calculation results with the digital certificate digest. If they are the same, it is determined that the verification has passed. If there is a difference, the verification is judged to have failed.

  At 370, if the verification passes, the server may perform the service, and if the digital certificate verification fails, an associated prompt message may be returned to the client terminal.

  The digital certificate verification method of the present disclosure will be described in detail below with reference to FIG. FIG. 4 is a schematic diagram illustrating an interaction between a browser 402 and a server in an example digital certificate validation method according to another embodiment of the present disclosure. The login server 404 and the service server 406 may be the same server or different servers. In FIG. 4, two servers are shown. The login server 404 may be a server that executes user login, and the service server 406 may be a server that executes a specific service.

  As illustrated in FIG. 4, when the user performs a login operation in 410, the browser 402 may send a login request to the login server 404 and request the login server 404 to execute the user login. The login server 404 verifies whether the user's account, password, and the like match. If they match, the user is logged in, and the page content is returned to the browser 402 after successful login. Browser 402 may render and display the page according to the data returned by login server 404.

  In 420, the browser 402 of the client terminal collects the digital certificate installed in the local client, performs a digest calculation of the digital certificate collection result, generates a digital certificate digest, and caches the digital certificate digest. . The browser 402 may cache the digital certificate digest generated in the cookie file.

  According to an example embodiment of the present disclosure, as shown in FIG. 4, at 410 ′, when a user logs into a website or web page application via the browser 402 of the client terminal, the browser 402 may log into the website login server 404. The login server 404 may receive the login request and perform login of the user according to the login request. The login server 404 may further perform operations such as user account and password verification. If the verification passes, the login server 404 may execute a user login operation and return a script to the browser 402 of the client terminal. The browser 402 may perform operations such as collecting a user's digital certificate, generating a digital certificate digest, and caching a digital certificate digest by executing a script (refer to 410 ′ in FIG. 4). The script may be computer executable code written in a script language, and the script may be placed in web page data returned to the client terminal and returned to the browser 402 of the client terminal. Upon receiving the web page data returned by the server (page data after login, etc.), the browser 402 executes a script to collect the digital certificate installed on the client terminal, and calculates the digest of the certificate collection result. Go to generate a certificate digest and cache the certificate digest in a cookie.

The following is an example script that caches a certificate digest according to an example embodiment of the present disclosure.
Document. cookie = “certDigest =” + certDigest

  In 430, the browser 402 of the client terminal transmits a service request including the cached digital certificate digest to the service server 406 in response to the user operation. When the service corresponding to the service request is a service that requires verification of the digital certificate, the service server 406 verifies the digital certificate digest, and executes the service when the verification is passed.

  According to example embodiments of the present disclosure, service server 406 may be a corresponding service server used to perform an operation performed by a user. For example, when the operation performed by the user is account transfer, the service server 406 may be a server that executes a transfer service, that is, a transfer server. When the operation performed by the user is payment, the service server 406 may be a server that executes a payment service, that is, a payment server. The browser 402 may transmit a service request including the digital certificate digest to the corresponding service server 406 according to the operation performed by the user, and the service requested by the service request may be a service corresponding to the operation performed by the user. . For example, if the user performs an account transfer, the browser 402 sends a transfer request to the transfer server, and the browser 402 places a cookie file containing the user's digital certificate digest in the request and You may transmit to a transfer server.

  At 440, service server 406 receives the service request. When the service corresponding to the service request is a service that requires verification of the digital certificate, the service server 406 verifies the digital certificate digest, and executes the service when the verification is passed. In other words, when receiving the service request, the service server 406 determines whether the service corresponding to the service request is a service that requires verification of the digital certificate. If the service corresponding to the service request is not a service that requires digital certificate verification, the service server may directly execute the service. If the service corresponding to the service request is a service that requires verification of a digital certificate, for example, a service having high security requirements such as payment, transfer, and withdrawal, the service server performs the digital certificate digest of the user. May be collected from the request, verified, and determined whether the service may be executed. For example, when the operation performed by the user is account transfer, the transfer server may collect the user's digital certificate digest from the cookie included in the transfer request transmitted by the browser 402 and verify the digital certificate digest. .

  The service server 406 may verify the digital certificate digest according to the following operation. The digest calculation of the user's digital certificate stored in the service server is performed using the digest algorithm employed for generating the digital certificate digest. Compare the digest calculation results with the digital certificate digest. If they are the same, it is determined that the verification has passed. If there is a difference, the verification is judged to have failed.

  For example, when the algorithm adopted for generating the digital certificate digest of the user is MD5, digest calculation related to the digital certificate is performed using the MD5 algorithm, and the result of the digest calculation is the digital certificate of the user obtained from the request. Compared with the book digest. If they are the same, it is judged that the verification has passed. If there is a difference, the verification is judged to have failed.

  If the verification is passed at 450, the service server 406 executes the service. In other words, when the verification of the digital certificate is passed, the service server 406 may execute a service corresponding to the operation performed by the user according to the service request transmitted by the browser 402. If verification fails, a corresponding prompt message such as a verification failure prompt message may be returned to the browser.

  Comparing FIG. 4 with FIG. 1, under the technique of the present disclosure, the browser of the client terminal only needs to collect the certificate, generate the certificate digest, and cache the certificate digest. There is no need to submit certificate information via This reduces the number of requests sent to the server. The login server only needs to execute the login operation of the user, and it is not necessary to perform operations such as certificate verification other than login and cache of certificate verification results.

  FIG. 5 shows a structural diagram of an example of an apparatus 500 for processing a digital certificate according to an embodiment of the present disclosure. As shown in FIG. 5, the device 500 may include one or more processors or data processing devices 502 and a memory 504. System 500 may further include one or more input / output devices and a network interface (not shown in FIG. 5). Memory 504 is an example of a computer-readable medium.

  Memory 504 may store a plurality of modules or units therein, including collection module 510, digest module 520, cache module 530, and transmission module 540.

  The collection module 510 collects the user's digital certificate. The digest module 520 performs a digest calculation of the digital certificate collection result to generate a digital certificate digest for the user. The cache module 530 caches the digital certificate digest. The transmission module 540 transmits a service request including the cached digital certificate digest to the service server in response to a user operation, and as a result, the service corresponding to the service request needs to verify the digital certificate. When it is a service, the service server verifies the digital certificate digest and executes the service if the verification passes.

  According to example embodiments of the present disclosure, when the user performs a login operation, the transmission module 540 may further transmit a login request to the login server. The login server and the service server may be the same server or different servers.

  According to example embodiments of the present disclosure, the collection module 510 may further collect the user's digital certificate when the user performs a login operation. The cache module 530 may further cache the digital certificate digest in a cookie.

  According to example embodiments of the present disclosure, a digest algorithm employed to perform a digest calculation on a digital certificate collection result may include MD5. The service server may further perform a digest calculation of the user's digital certificate stored in the service server using the digest algorithm employed to generate the digital certificate digest, and the result collected by the digest calculation may be digitally certified. You may compare it with the book digest. If they are the same, the service server determines that the verification has passed. If there is a difference, the service server determines that the verification of the digital certificate has failed.

  FIG. 6 shows a structural diagram of an example system 600 for verifying a digital certificate according to an embodiment of the present disclosure. As shown in FIG. 6, the system 600 may include a client terminal 602 and a service server 604.

  The client terminal 602 may include one or more processors or data processing devices 606 and a memory 608. The client terminal 602 may further include one or more input / output devices and a network interface (not shown in FIG. 6). Memory 604 is an example of a computer readable medium. Memory 608 may store a plurality of modules or units, including collection module 610, digest module 612, cache module 614, and transmission module 616.

  The collection module 610 collects the user's digital certificate. The digest module 612 generates a digital certificate digest of the user by performing a digest calculation of the digital certificate collection result. The cache module 614 caches the digital certificate digest. The sending module 616 sends a service request including the cached digital certificate digest to the service server in response to a user operation.

  The service server 604 may include one or more processors or data processing devices 618 and a memory 620. The service server 604 may further include one or more input / output devices and a network interface (not shown in FIG. 6). Memory 620 is an example of a computer readable medium. Memory 620 may store a plurality of modules or units including receiving module 622 and verification module 624 therein.

  The reception module 622 receives a service request. The verification module 624 verifies the digital certificate digest when the service corresponding to the service request is a service that requires verification of the digital certificate.

  According to the embodiment of the present disclosure, the transmission module 616 may further transmit a login request to the login server when the user performs a login operation. The system 600 may further include a login server (not shown in FIG. 6) that receives the login request and performs a user login operation in accordance with the login request.

  According to example embodiments of the present disclosure, the collection module 610 may further collect the user's digital certificate when the user performs a login operation.

  According to example embodiments of the present disclosure, the service server 604 may further include an execution module (not shown in FIG. 6) that executes the service if the verification passes.

  According to example embodiments of the present disclosure, the validation module 624 may further perform a digest calculation of the user's digital certificate stored in the service server using a digest algorithm employed to generate the digital certificate digest, The results collected by the digest calculation may be compared with the digital certificate digest. If they are the same, the verification module 624 determines that the verification has passed, and if there is a difference, the verification module 624 determines that the certificate verification has failed.

  Since the operations performed by the apparatus of this embodiment substantially correspond to the operations of the method embodiment shown in FIGS. 1-4, the related description of the apparatus embodiment refers to the method embodiment. May not be repeated here.

  In a typical configuration, a computer device such as a client terminal or server comprises one or more processors or central processing units (CPUs), input / output interfaces, network interfaces, or memory.

  The memory may be computer readable media including volatile memory, random access memory (RAM), and / or non-volatile memory such as, for example, read only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

  Computer-readable media includes permanent, temporary, mobile, and fixed media and may implement information using any method or technique. Information may be computer readable or computer executable instructions, data structures, program modules or other data. Examples of computer readable media are phase change RAM (PRAM), static RAM (SRAM), dynamic RAM (DRAM), other types of RAM, ROM, electrical, which can be used to store information accessible to computing devices. Erasable programmable ROM (EEPROM), flash memory, or other internal memory technology, CD-ROM, digital versatile disk (DVD) or other optical memory, cassette, cassette and disk memory, or other magnetic memory device Or any other non-transmission medium, including but not limited to. In accordance with the definitions herein, computer-readable media does not include transitory media such as modulated data signals and carrier waves.

  The word “include” and variations thereof are intended to be non-exclusive, so that a process, method, item, or apparatus containing a series of elements is not only explicitly listed but also those elements. It should be noted that other elements that are not included, or that further include elements inherent in the process, method, item or apparatus. An element defined by the description “including a...” Does not exclude an additional identical element in the element's process, method, item, or apparatus.

  Those skilled in the art will appreciate that the embodiments of the present disclosure may be provided as a method, system, or computer program product. Accordingly, the present disclosure may be implemented as a hardware embodiment, a software embodiment, or a combination of software and hardware. Furthermore, the present disclosure is in the form of a computer program product implemented on one or more computer-readable media (including but not limited to magnetic disk memory, CD-ROM, optical memory, etc.) containing computer-executable instructions. It may be.

  The foregoing descriptions are merely embodiments of the present disclosure and are not intended to limit the present disclosure. Those skilled in the art will appreciate that the present disclosure may have various modifications and changes. All modifications, equivalent replacements, improvements, etc. made within the spirit and principle of this disclosure are intended to be within the scope of the claims of this disclosure.

Claims (20)

Collecting a user's first digital certificate by a client terminal;
Performing a digest calculation of the collection result of the first digital certificate to generate a digital certificate digest of the first digital certificate;
Caching the digital certificate digest of the first digital certificate;
In response to the user operation, sending a service request including the cached digital certificate digest to a service server;
Including methods. Receiving the service request by the service server;
Determining whether the service corresponding to the service request is a service that requires verification of a digital certificate;
Executing the service in response to determining that the service corresponding to the service request is a service that does not require verification of the digital certificate; or
In response to determining that the service corresponding to the service request is a service that requires verification of the digital certificate, the digital certificate digest of the first digital certificate is stored in the service server. Verifying with the user's second digital certificate,
The method of claim 1, further comprising: The verification is
Performing a digest calculation on the second digital certificate of the user stored in the service server using a digest algorithm employed to generate the digital certificate digest of the first digital certificate;
Comparing the result calculated by the digest calculation of the second digital certificate with the digital certificate digest of the first digital certificate;
In response to determining that the result calculated by the digest calculation of the second digital certificate is the same as the digital certificate digest of the first digital certificate, the result of the verification is Judging that it is acceptable,
The method of claim 2 comprising:   The method of claim 3, wherein the digest algorithm is a message digest algorithm 5 (MD5) algorithm.   The method of claim 2, further comprising executing the service in response to determining that the result of the verification is acceptable.   The method of claim 1, further comprising transmitting a login request to a login server upon receiving a login request from the user, wherein the login server and the service server are the same server or different servers.   The method of claim 1, wherein collecting the first digital certificate of the user comprises collecting the first digital certificate of the user when receiving a login request from the user. .   The method of claim 1, wherein the caching the digital certificate digest includes caching the digital certificate digest in a cookie file. A system including a client terminal,
The client terminal is
A collection module for collecting the user's first digital certificate;
A digest module that performs a digest calculation of the collection result of the first digital certificate to generate a digital certificate digest of the first digital certificate;
A cache module that caches the digital certificate digest of the first digital certificate;
A transmission module for transmitting a service request including the cached digital certificate digest to a service server in response to the operation of the user;
Comprising the system. A service server, the service server comprising:
A receiving module for receiving the service request;
It is determined whether the service corresponding to the service request is a service that requires verification of a digital certificate, and the service corresponding to the service request is a service that requires verification of the digital certificate. A verification module that verifies the digital certificate digest of the first digital certificate using the second digital certificate of the user stored in the service server in response to being determined to be; ,
10. The system of claim 9, comprising: The verification module further includes:
Performing a digest calculation on the second digital certificate of the user stored in the service server using a digest algorithm employed to generate the digital certificate digest of the first digital certificate;
Comparing the result calculated by the digest calculation of the second digital certificate with the digital certificate digest of the first digital certificate;
In response to a determination that the result calculated by the digest calculation of the second digital certificate is the same as the digital certificate digest of the first digital certificate, the verification result is passed to decide,
The system according to claim 10.   The system according to claim 11, wherein the digest algorithm is a message digest algorithm 5 (MD5) algorithm.   The system of claim 10, wherein the service server further comprises an execution module that executes the service in response to a determination that a verification result is acceptable.   The service server further comprises an execution module that executes the service in response to determining that the service corresponding to the service request is a service that does not require verification of the digital certificate. System.   The transmission module further transmits a login request to a login server when the client terminal receives a login request from the user, and the login server and the service server are the same server or different servers. system.   The system of claim 9, wherein the collection module further collects the first digital certificate of the user upon receiving a login request from the user.   The system of claim 9, wherein the cache module further caches the digital certificate digest in a cookie file. One or more memories storing computer-executable instructions, said computer-executable instructions being executed by one or more processors;
Collecting the user's first digital certificate;
Performing a digest calculation of the collection result of the first digital certificate to generate a digital certificate digest of the first digital certificate;
Caching the digital certificate digest of the first digital certificate;
In response to the user operation, sending a service request including the cached digital certificate digest to a service server;
One or more memories that cause a computer to perform operations including:   The one or more memories of claim 18, wherein the operation further comprises collecting the first digital certificate of the user upon receiving a login request from the user.   The one or more memories of claim 18, wherein the operation further comprises caching the digital certificate digest in a cookie file.

Images